AZ-900 Practice Exam 4 — 20 Questions

Question 1

A company has a root management group that contains all Azure subscriptions. A centralized governance team needs to create and assign Azure Policy definitions and set initiatives that apply to all subscriptions. Which built-in role should be assigned to the governance team at the root management group scope to grant the minimum required permissions?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Policy Contributor. The Policy Contributor built-in role grants the minimum required permissions to create and assign Azure Policy definitions and initiatives, including the ability to read policy assignments and manage policy resources, without granting full write access to all resources. Assigning this role at the root management group scope ensures the governance team can apply policies across all subscriptions while adhering to the principle of least privilege.

Answer

Owner

Answer

Contributor

Answer

Security Admin

Question 2

A multinational company has a strict data residency requirement: all Azure virtual machines must be deployed only in the East US or West Europe Azure regions. The IT governance team wants to enforce this rule automatically so that any attempt to create a virtual machine in any other region is blocked immediately at the time of deployment. Users must receive a clear error message if they try to create a VM in a disallowed region. Which Azure feature should the governance team configure to meet this requirement?

Accepted Answer

Configure an Azure Policy with the Deny effect assigned to the subscription scope.. Azure Policy with the Deny effect is the correct choice because it enforces organizational rules by evaluating resource properties during deployment and blocking any non-compliant request. In this scenario, a policy can be defined to deny virtual machine creation in any region other than East US or West Europe, and the Deny effect ensures the deployment fails with a clear error message, meeting the real-time enforcement requirement.

Answer

Create a resource lock on the subscription to prevent all resource creation.

Answer

Assign an Azure RBAC role that denies create permissions for VMs in disallowed regions.

Answer

Set up a budget alert in Cost Management to notify when a VM is created in a disallowed region.

Question 3

A company operates a hybrid IT environment with virtual machines running on-premises and in Amazon Web Services (AWS). The company also has a growing number of resources in Microsoft Azure. To simplify management, the company wants to use a single Azure service to apply Azure Policy definitions and enable unified inventory and tagging across all virtual machines, regardless of their location. Which Azure service should the company use?

Accepted Answer

Azure Arc. Azure Arc extends Azure Resource Manager (ARM) and Azure Policy to non-Azure environments, including on-premises and AWS virtual machines. By installing the Azure Connected Machine agent on each VM, the company can apply Azure Policy definitions and use unified inventory and tagging across all VMs from a single Azure control plane.

Answer

Azure Resource Manager

Answer

Azure Blueprints

Answer

Azure Management Groups

Question 4

A hospital is migrating patient data to the cloud. The hospital is responsible for managing who can access the data and for encrypting the data before upload. The cloud provider is responsible for securing the physical datacenters, network infrastructure, and hypervisor. This division of security responsibilities is described by which model?

Accepted Answer

Shared responsibility model. The shared responsibility model defines the division of security obligations between the cloud provider and the customer. In this scenario, the hospital (customer) is responsible for identity and access management (IAM) and data encryption at rest and in transit, while the cloud provider secures the physical datacenter, network infrastructure, and hypervisor. This clear separation of duties is the core of the shared responsibility model, which varies by service model (IaaS, PaaS, SaaS).

Answer

Defense in depth

Answer

Principle of least privilege

Answer

Zero trust model

Question 5

A company deploys a critical application across two Azure regions for disaster recovery. They want to automatically failover traffic to the secondary region if the primary becomes unavailable. They also want to improve performance by routing users to the closest region. Which Azure service should they use?

Accepted Answer

Azure Traffic Manager. Azure Traffic Manager is a DNS-based traffic load balancer that enables you to distribute traffic optimally to services across global Azure regions. It supports the 'Priority' routing method for automatic failover to a secondary region when the primary is unavailable, and the 'Performance' routing method to direct users to the closest region for improved latency. This combination directly meets the stated requirements for disaster recovery failover and performance-based routing.

Answer

Azure Load Balancer

Answer

Azure Application Gateway

Answer

Azure VPN Gateway

Question 6

A company has 15 Azure subscriptions organized under multiple management groups. The security team has defined a standard set of 8 Azure Policy definitions that must be applied to every subscription. These definitions enforce required tags, deny creation of public IPs, require encryption for storage accounts, and restrict VM SKUs. The team wants to assign these policies as a single entity to simplify management and ensure consistent compliance. What should the team create and assign?

Accepted Answer

An Azure Policy initiative (policy set definition) containing the policy definitions. An Azure Policy initiative (policy set definition) allows grouping multiple individual policy definitions into a single set, which can then be assigned as one entity. This simplifies management and ensures consistent compliance across all subscriptions, as the security team requires. Assigning the initiative at the root management group applies it to all 15 subscriptions under the management groups.

Answer

An Azure Blueprint containing the policy definitions

Answer

An Azure Policy assignment for each individual definition at the root management group

Answer

An Azure Resource Manager template that deploys the policy definitions

Question 7

What is the shared responsibility model in cloud computing?

Accepted Answer

A framework dividing security responsibilities between the cloud provider and the customer. The shared responsibility model defines the division of security and compliance obligations between the cloud provider and the customer. The provider is responsible for the security 'of' the cloud (physical hosts, network, hypervisor), while the customer is responsible for security 'in' the cloud (data, access management, OS configuration). This division varies by service model (IaaS, PaaS, SaaS), but the core principle is that security is a shared, not transferred, responsibility.

Answer

The provider and customer each pay half the cost of cloud services

Answer

An agreement where customers share their infrastructure with other cloud users

Answer

A service where two cloud providers share management of customer workloads

Question 8

A company's IT manager is evaluating a public cloud provider. The provider's data center contains powerful physical servers that host virtual machines from thousands of different organizations. The manager is concerned about security, but the provider assures that each organization's VMs are logically isolated and cannot access each other's data, even though they share the same hardware. Which essential characteristic of cloud computing does this scenario best describe?

Accepted Answer

Resource pooling. The scenario describes resource pooling because the provider's physical servers host VMs from multiple organizations, and logical isolation ensures each tenant's data remains separate. Resource pooling is the cloud characteristic where computing resources (e.g., storage, processing, memory) are aggregated to serve multiple customers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to demand. The provider's assurance of logical isolation (e.g., via hypervisor-level segmentation or VLANs) is a direct implementation of resource pooling's security boundary.

Answer

Rapid elasticity

Answer

Measured service

Answer

Broad network access

Question 9

A company wants to deploy a virtual machine in Azure and needs to ensure that the VM is placed in a location that provides the lowest network latency to its users in Europe. Which Azure construct should they consider to meet this requirement?

Accepted Answer

Azure region. Azure regions are geographically discrete data center groupings that provide low-latency connectivity to users within that region. By deploying the VM in a Europe-based region (e.g., West Europe or North Europe), the company ensures the shortest physical distance and network path to its European users, minimizing latency. Availability zones, resource groups, and management groups do not influence geographic placement or network latency.

Answer

Azure availability zone

Answer

Azure resource group

Answer

Azure management group

Question 10

Which Azure storage redundancy option replicates data synchronously across three availability zones within a single region?

Accepted Answer

Zone-Redundant Storage (ZRS). Zone-Redundant Storage (ZRS) is the correct answer because it synchronously replicates data across three Azure availability zones within a single region, ensuring high durability and availability even if an entire zone fails. This meets the exact requirement of the question: synchronous replication across multiple zones in one region.

Answer

Locally Redundant Storage (LRS)

Answer

Geo-Redundant Storage (GRS)

Answer

Geo-Zone-Redundant Storage (GZRS)

Question 11

An organization needs to ensure all VMs in Azure use approved VM sizes only. Which Azure feature enforces this?

Accepted Answer

Azure Policy with allowed VM SKU policy. Azure Policy with the 'Allowed virtual machine SKUs' built-in policy definition enforces which VM sizes can be deployed in a subscription or resource group. When assigned, this policy evaluates all VM creation or update requests and denies any that use a SKU not included in the allowed list, ensuring compliance with organizational standards.

Answer

Azure RBAC

Answer

Azure Resource Manager locks

Answer

Azure Cost Management budgets

Question 12

A company wants to run a containerized microservices application on Azure. The application requires automatic scaling, service discovery, and rolling updates without manual intervention. They prefer not to manage the underlying virtual machines. Which Azure compute service should they choose?

Accepted Answer

Azure Kubernetes Service (AKS). Azure Kubernetes Service (AKS) is the correct choice because it provides a fully managed Kubernetes orchestration platform that handles automatic scaling (via Horizontal Pod Autoscaler), service discovery (via Kubernetes DNS and Services), and rolling updates (via Deployment strategies) without requiring you to manage the underlying virtual machines. AKS abstracts the control plane and node management, allowing you to focus on deploying and managing containerized microservices.

Answer

Azure Container Instances

Answer

Azure App Service

Answer

Azure Functions

Question 13

A company runs a critical ERP system on-premises and plans to extend the application to Azure IaaS VMs for burst capacity. The network team requires a dedicated, private connection between the on-premises data center and Azure that does not traverse the public internet. The connection must offer consistent latency, high bandwidth options up to 10 Gbps, and a financially backed SLA for availability. Which Azure service should the team provision to meet these requirements?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute provides a dedicated, private connection from on-premises to Azure that bypasses the public internet, ensuring consistent latency and high bandwidth up to 10 Gbps. It also offers a financially backed SLA for availability, making it the ideal choice for extending a critical ERP system for burst capacity with predictable performance.

Answer

Azure VPN Gateway (site-to-site)

Answer

Azure Front Door

Answer

Azure Bastion

Question 14

A company has multiple Azure subscriptions used by different departments. The security team wants to enforce a requirement that all Azure Storage accounts in every subscription must be encrypted at rest using customer-managed keys (CMK). The solution must automatically evaluate existing and new storage accounts for compliance, and it must be able to automatically remediate non-compliant resources by enabling CMK encryption. The team wants to use a single, centralized Azure feature that can be assigned once and apply to all subscriptions. Which Azure feature should they use?

Accepted Answer

Azure Policy. Azure Policy is the correct choice because it can enforce organizational standards and assess compliance across all Azure subscriptions from a single assignment. By using a built-in or custom policy definition that requires storage accounts to use customer-managed keys (CMK) for encryption at rest, Azure Policy can automatically evaluate both existing and new storage accounts. With the 'DeployIfNotExists' effect, it can also trigger remediation tasks to enable CMK encryption on non-compliant resources without manual intervention.

Answer

Azure Blueprints

Answer

Azure Role-Based Access Control (RBAC)

Answer

Azure Security Center (Microsoft Defender for Cloud)

Question 15

A global company is designing a disaster recovery solution for a critical application. They plan to deploy the application to two Azure regions. The company wants to minimize the risk of both regions failing simultaneously due to a major platform update or a widespread natural disaster. Which Azure feature provides a specific pairing of regions to meet this goal?

Accepted Answer

Azure region pairs. Azure region pairs are designed to ensure that two paired regions are updated sequentially during platform maintenance, reducing the risk of simultaneous failure. They are also physically separated by at least 300 miles to minimize the impact of natural disasters. This meets the company's goal of minimizing simultaneous failure risk from both a major platform update and a widespread natural disaster.

Answer

Availability Zones within a single region

Answer

Azure Traffic Manager with geographic routing

Answer

Azure Site Recovery replication between any two regions of your choice

Question 16

A company has a policy that all Azure resources must have a tag named 'CostCenter'. The governance team wants to automatically add the tag with a default value 'IT' to any new resource that is created without it. The team wants the tag to be applied during resource creation, not just report non-compliance. The solution must also support remediation for existing non-compliant resources if needed later. Which Azure Policy effect should the team use in their policy definition?

Accepted Answer

Modify. The Modify effect is correct because it can automatically add or change tags on resources during creation or update, enforcing compliance in real-time. Unlike Append, Modify supports both creation and remediation of existing resources, and unlike DeployIfNotExists, it directly alters the resource properties without deploying a separate remediation task.

Answer

Append

Answer

DeployIfNotExists

Answer

Audit

Question 17

A company migrates its web application to Azure App Service (Platform as a Service). The application processes sensitive customer data and must ensure that all data in memory is encrypted while the application is running. According to the shared responsibility model, which party is responsible for implementing encryption of data in memory for this application?

Accepted Answer

The company, because it is responsible for securing its own application data and code.. In the shared responsibility model for PaaS like Azure App Service, Microsoft secures the physical host, OS, and platform runtime, but the customer retains responsibility for securing application-level data, including data in memory. Encrypting data in memory requires application code changes (e.g., using .NET's `ProtectedMemory` or Windows DPAPI), which is solely the customer's responsibility because Microsoft cannot access or manage the application's runtime memory contents.

Answer

Microsoft Azure, because it provides the hosting infrastructure and manages the runtime environment.

Answer

Both Microsoft and the company share this responsibility equally.

Answer

A third-party encryption service that is automatically enabled for all Azure App Service deployments.

Question 18

A small business runs its IT infrastructure in a small on-premises server room. The business owner is considering moving to Azure and asks the IT manager: 'How can a large cloud provider like Microsoft offer compute and storage at a lower per-unit cost than I can get by purchasing my own servers, even though I only need a few virtual machines?' Which cloud computing benefit best answers this question?

Accepted Answer

Economies of scale. Economies of scale allow Microsoft to spread massive capital and operational costs (data center construction, power, cooling, hardware procurement) across millions of customers. This per-unit cost reduction means even a small business consuming only a few virtual machines benefits from the same low-cost infrastructure that a large enterprise would, making Azure's compute and storage cheaper than purchasing and maintaining dedicated on-premises servers.

Answer

High availability

Answer

Elasticity

Answer

Fault tolerance

Question 19

A company migrates its web application to Azure. The CFO wants to view detailed reports of CPU usage, storage consumption, and network bandwidth for each team's resources to accurately allocate costs. The company uses Azure Cost Management and Billing to generate these reports. Which characteristic of cloud computing does this capability best illustrate?

Accepted Answer

Measured service. Measured service is the cloud characteristic that enables providers to track and report resource usage (CPU, storage, bandwidth) for billing and cost allocation. Azure Cost Management and Billing leverages this capability by aggregating consumption metrics from Azure Monitor and resource providers, then generating detailed reports that allow the CFO to allocate costs per team. Without measured service, granular usage-based billing and cost attribution would not be possible.

Answer

Rapid elasticity

Answer

Resource pooling

Answer

On-demand self-service

Question 20

A development team frequently needs to create and tear down test environments. In their on-premises datacenter, they must submit a ticket to the IT operations team, which often takes several days to provision the required servers. After migrating to Azure, developers can now create virtual machines, databases, and other resources directly through the Azure portal or using PowerShell scripts, without any interaction from the IT operations team. This ability to provision cloud resources directly is a direct example of which fundamental characteristic of cloud computing?

Accepted Answer

On-demand self-service. The scenario describes developers provisioning virtual machines, databases, and other resources directly through the Azure portal or PowerShell scripts without needing to interact with the IT operations team. This is the definition of on-demand self-service, a core characteristic of cloud computing defined by NIST (SP 800-145) as a consumer being able to unilaterally provision computing capabilities without requiring human interaction with each service provider.

Answer

Resource pooling

Answer

Measured service

Answer

Rapid elasticity